- /file and /pdf endpoints: make token optional, fall back to hnf_session
cookie auth when no valid JWT token provided. Kitchen frontend passes the
literal '__session__' compat shim so token-only auth always 401'd.
- Add Request injection so cookie-based fallback path can read hnf_session.
- nginx: add types block mapping .mjs → text/javascript so pdf.worker.min.mjs
passes browser strict MIME check for ES module scripts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove stale import of non-existent require_cap_from_token from
get_invoice_file endpoint — caused ImportError → 500 on every PDF load
- Fix pdf.js worker path from '/pdf.worker.min.mjs' to '/kitchen/pdf.worker.min.mjs'
in Review.tsx and SearchDefinitions.tsx — worker was being fetched from domain
root instead of under the /kitchen/ base, causing MIME type rejection
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The full Purchases.tsx page at /purchases (multi-week tables, date range picker,
disputes/allowances rows, 24-week comparison chart) was already ported but had
no sidebar nav entry. Adds it under Invoices → Purchases Chart and removes the
simplified single-week PurchasesCalendar placeholder that replaced it.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backend endpoint /api/reports/purchases/weekly existed but had no frontend.
Adds PurchasesCalendar page under Invoices > Purchases Chart: 7-day columns,
one row per supplier, each cell lists invoice chips (number + total) linking
to the invoice detail. Daily totals row in footer, prev/next week navigation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bare <a href="/invoice/..."> tags bypass React Router basename, causing
hard navigations to absolute paths with no NPM route. Added /kitchen/
prefix to all internal href values across 12 components.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Frontend sends lowercase status (e.g. 'confirmed'), but the DB enum values
are uppercase (CONFIRMED). Uppercase the parameter before comparison.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Migrations used try/except around ADD COLUMN inside a single engine.begin()
block. When a 'column already exists' error was caught, asyncpg left the
transaction in aborted state, causing all subsequent DDL in the block to fail
with InFailedSQLTransactionError. Replace with IF NOT EXISTS to prevent the
error entirely.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- nginx client_max_body_size raised to 800m (was 20m) to allow 577MB backup
upload; proxy_read_timeout raised to 600s for long restore operations
- Add api/kds_settings.py: GET+PATCH /api/kds/settings served by kitchen
backend (kitchen Settings page configures KDS timers/GraphQL/course order;
all config lives in kitchen_settings so kitchen owns these endpoints)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
kitchen_settings has a FK to kitchens.id — on a fresh kitchen_db the
kitchens table is empty, so any restore attempt fails with a FK violation.
Idempotent INSERT ON CONFLICT DO NOTHING runs after create_all on every boot.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
All archive components were calling fetch('/api/...') directly. Replaced
all occurrences of /api/ URLs (string literals, template literals,
window.open, src attributes) with /kitchen/api/ across 37 source files.
The central axios instance in api.ts was already correct.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
?token= query-param endpoints (PO/invoice print previews, recipe image exports,
backup download) call get_current_user_from_token which was not ported from the
original archive auth module. Added the function and fixed the missing import in
backup.py, ingredients.py, and invoices.py.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
